OWASP 25th Anniversary Virtual Conference (September)

Every time we set up an MCP server, something felt off. Adding one is as simple as adding a JSON entry that points to a third-party process. Restart your client, and that server's outputs now flow directly into your agent's context — treated with the same trust as your own instructions. It can access whatever you've granted it — files, API tokens, tool outputs — with no verification that it's still the same code you originally approved. There are no signature checks, no permission reviews, and no clear way to know if what you installed today is still what's running next week.

That gap in trust is what this talk is about.

MCP servers are starting to show up everywhere as a way to extend AI agents with external tools. Unlike traditional plugins, they run inside the agent's workflow, which means they can see task context and credentials passed between tools.

Through live demos, we'll show two attack paths:

- A rogue server that looks legitimate from day one
- A remotely hosted server that operates correctly until a server-side update changes its behavior with no client notification and no re-authorization prompt

In both cases, nothing is "exploited" in the traditional sense. These attacks work because of the system's design. We demonstrate that the same malicious server is running in both Anthropic Claude Desktop and Visual Studio Code, showing this isn't tied to a single client but to a broader architectural issue.

You'll see how an attacker could exfiltrate sensitive data, access credentials, and observe or even influence multi-step agent workflows.

Then we'll walk through what you can actually do about it. That includes server allowlisting, version pinning, monitoring outbound connections from agent processes, auditing permissions, and treating MCP updates the same way you treat third-party code changes.

We'll close with a few things the ecosystem still needs to fix, such as signed updates, better visibility into permission changes, and stronger guarantees for plugin integrity.

Distributed systems increasingly face security and privacy risks as data flows across services without sufficient visibility or enforcement. Regulatory actions have highlighted how combining user data without informed consent can lead to exploitative outcomes, reinforcing the need for real-time, security-driven controls rather than retrospective audits. This session presents a privacy-aware infrastructure that embeds compliance and security enforcement directly into distributed architectures.

The framework uses Policy Zones and metadata-driven controls to segment data flows and enforce purpose limitations across services. Automated classification pipelines assign sensitivity attributes at ingestion, enabling consistent enforcement as data moves through systems. Template-based policies and simplified APIs support scalable implementation while maintaining strong governance controls.

Machine learning techniques enhance detection capabilities by classifying sensitive data, identifying cross-service violations, and detecting anomalous patterns in data movement. Methods such as entity recognition, clustering, and temporal anomaly detection enable continuous monitoring of complex, distributed environments.

A provenance-aware auditing layer provides traceability of data lineage and processing history, supporting verification and forensic analysis. These controls help prevent unauthorized data combinations and ensure that usage aligns with declared purposes across system boundaries.

The session also examines enforcement across microservices and multi-jurisdiction deployments, highlighting patterns that strengthen system security while maintaining compliance. This approach provides a practical blueprint for building secure, privacy-aware distributed systems aligned with modern application security principles.

Your AI agent works great in the demo. Then you deploy it and it hallucinates a refund policy that costs you $10K, or exposes customer data, or just loops endlessly burning tokens.

This session explores how to build AI agents you can trust in production using Amazon Bedrock AgentCore and the Strands Agents SDK.

We’ll walk through a layered approach to agent safety that spans guardrails at multiple levels, including input validation, output filtering, and action approval, along with observability patterns that make agent behavior transparent and auditable.

You’ll also see how multi-agent architectures can be designed so agents steer and check one another, and how security policies combined with deliberate prompt design reduce risk across the system.

We'll walk through a reference architecture that combines these layers, and you'll learn how each layer can catch failures.

You should have basic familiarity with LLMs and AI agents. You'll leave with architectures pattern you can adapt and a clearer picture of what can go wrong and how to address common issues with AI agent trust and reliability.

Detecting vulnerabilities in compiled binaries remains a major challenge for security teams, especially when software is reused across different architectures, compilers, and optimization settings. These variations significantly alter binary representations, making traditional detection techniques brittle and difficult to scale.

This talk introduces AMMF (Attention-Driven Multi-Feature Fusion), a novel approach for cross-architecture binary vulnerability detection that combines semantic understanding with structural analysis. AMMF leverages assembly-level embeddings to capture instruction semantics, while integrating control-flow and function-level attributes to model program behavior. An attention-enhanced neural architecture unifies these diverse features into a robust representation that generalizes across heterogeneous environments.

To improve both scalability and precision, AMMF employs a two-stage detection pipeline. First, a deep similarity model efficiently identifies high-risk candidate functions from large binary corpora. Then, a graph-matching refinement step analyzes control-flow structures to confirm vulnerabilities and reduce false positives.

In experimental evaluations, AMMF achieves 95.79% accuracy and 97.06% recall, outperforming current state-of-the-art methods across cross-architecture, cross-compiler, and cross-optimization scenarios.

This session will demonstrate how combining machine learning, attention mechanisms, and program analysis can significantly improve vulnerability detection in real-world software supply chains—where code reuse and platform diversity are the norm.

Self-healing security test automation introduces a resilient approach to application security testing, addressing one of the most critical challenges in modern AppSec programs: maintaining effective test coverage in rapidly evolving systems. As applications undergo continuous updates, traditional security test scripts frequently fail due to UI, API, or infrastructure changes, leading to gaps in vulnerability detection and increased risk exposure.

This session explores how self-healing mechanisms—powered by machine learning, intelligent element recognition, and adaptive execution strategies—can be applied to security testing within OWASP-aligned frameworks. By automatically adjusting to application changes, these systems ensure consistent validation of security controls, including authentication flows, input validation, and access control mechanisms.

The proposed framework demonstrates high accuracy in identifying modified application elements and recovering failed test cases without human intervention. This capability significantly reduces maintenance overhead while improving the reliability of detecting vulnerabilities such as injection flaws, broken authentication, and misconfigurations.

Aligned with OWASP tracks including Testing, Implementation, and Process & Culture, this approach also supports the development of sustainable security practices by reducing operational friction for security and DevOps teams. Real-world implementations highlight measurable improvements in test stability, reduced false positives, and faster feedback loops.

Ultimately, self-healing security automation enables organizations to maintain continuous security assurance, strengthen AppSec programs, and adapt effectively to the evolving threat landscape.